OpenAI describes prompt injection as social engineering aimed at AI agents and lists its layered defenses: instruction-hierarchy safety training, automated red-teaming, AI-based monitors that can be updated quickly, sandboxing of code-running tools, link approval, confirmation before sensitive steps, logged-out mode in Atlas, and a watch mode on sensitive sites that pauses the agent if the user leaves the tab. It cites thousands of hours of prompt-injection-focused red teaming and a bug bounty, and says it has not yet seen significant attacker adoption of the technique.
It is OpenAI's reference statement of its agent prompt-injection defense stack for ChatGPT agent and Atlas.
Key facts
As stated in the sources, with where to find them.
- Measures listed: instruction-hierarchy safety training, automated red teaming, rapidly updatable monitors, sandboxing, link approval, confirmation prompts, logged-out mode, watch mode, bug bounty.'Our approach to protecting users' subsections
- OpenAI reports thousands of hours of internal and external red teaming focused specifically on prompt injection.'Red-teaming'
- OpenAI says it had not yet seen significant attacker adoption of prompt injection but expects adversaries to invest heavily in it.'Looking ahead'
Findings that cite this record
No tracked finding cites this record yet.
Key questions this bears on
- Can prompt injection against AI agents be reliably defended?Not reliably. Defenses reduce injection but none has eliminated it; limiting what untrusted input can trigger is the most defensible approach.
- Can AI agents defend and oversee systems on their own?Not yet. Agents are weak on realistic defensive benchmarks and monitors can be evaded; assistants help analysts who stay in charge.